@vnejs/bundles.canvas.react (>=0.1.1, <=0.2.0), @vnejs/bundles.checkers (>=0.2.1, <=0.2.3) +7 more potentially affected by CVE-2026-103922 via @capacitor/android (8.0.2)

@capacitor/android NPM version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/android and may be impacted: - @vnejs/bundles.canvas.react =0.1.1, =0.2.1, =0.1.0, =0.1.36, =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.2.20, =0.2.31 Source cves:...

@vnejs/bundles.canvas.react (>=0.1.1, <=0.2.0), @vnejs/bundles.checkers (>=0.2.1, <=0.2.3) +7 more potentially affected by CVE-2026-103922 via @capacitor/android (8.0.2)

@capacitor/android NPM version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @capacitor/android and may be impacted: - @vnejs/bundles.canvas.react =0.1.1, =0.2.1, =0.1.0, =0.1.36, =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.2.20, =0.2.31 Source cves:...

VaultSandbox

VaultSandbox Educational Android project demonstrating C...

Astra Linux – Vulnerability in Firefox

Multiple race conditions in the font initialization could have led to memory corruption and the execution of attacker-controlled code. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

Astra Linux – Vulnerability in Chromium

In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of offline features in Google Chrome on Android before version 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: x86-android-tablets: Fixed errors related to use of pdevs after the free function is called via platformdeviceregister. The x86androidtabletremove function frees the pdevs array; therefore, it should not be used...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Binder: Fix for UAF in alloc-vma during race with munmap cmllamas: Cleaned up the forward port from commit 015ac18be7de “Binder: Fix for UAF in alloc-vma during race with munmap” in 5.10 stable. This was necessary in the mainline...

Astra Linux – Vulnerability in Firefox

When a secure cookie exists in the Firefox cookie jar, an insecure cookie for the same domain could be created. This should have resulted in a silent failure. This could lead to a discrepancy in the expected results when reading from the secure cookie. This vulnerability affects Firefox for Andro...

Astra Linux – Vulnerability in Chromium

In the incorrect security interface in the navigation section of Google Chrome on Android, prior to version 92.0.4515.131, a remote attacker was able to spoof the contents of the Omnibox URL bar through a crafted HTML page...

MalwareSourceCode

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page 免責事項： 適用される法律で許容される最大限の範囲において、vx-underground およびコンテンツを vx-underground に提出した関連会社は、間接的、偶発的、特別、結果的、懲罰的損害賠償、または直接間接を問わず発生した利益や収入の損失、データ、使用、のれん、その他の無形資産の損失について、以下の事由に起因する場合、一切の責任を負いません。i...

Setup Wizard Privilege Escalation

The vulnerability of the Setup Wizard component in Android operating systems is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

Setup Wizard Privilege Escalation

The vulnerability of the Setup Wizard component in Android operating systems relates to the possibility of bypassing access control mechanisms. Exploiting this vulnerability allows a remote attacker to enhance their privileges...

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading th...

android-kernel-exploitation

Exploitazione del Kernel Android Obiettivo L'obiettivo di questo workshop è iniziare con l'analisi delle vulnerabilità del kernel e lo sfruttamento nella piattaforma Android. Utilizzo Clona il repository git clone https://github.com/cloudfuzz/android-kernel-exploitation /workshop URL delle Github...

CVE-2026-95358

An incorrect authorization flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553141660...

Androhack

AndroHack Advanced And...

PoC-Deployer-System

PoC-Deployer-System !License: MIThttps://img.shields.io/b...

ecapture — Updated!

eCapture 旁观者 Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. English · 汉字 !IMPORTANT Supports Linux on x8664 kernel 4.18+, aarch64 kernel 5.5+, and LoongArch64 loong64 kernel 6.6+. Android supports x8664 and aarch64 with the existing kernel minimums. Requires root...